Posts

The Problem: Conflicting MFA Configurations When your organization has both per-user Multi-Factor Authentication (MFA) and Conditional Access (CA) policies enabled simultaneously, per-user MFA takes precedence. This creates a cascading problem: users face excessive MFA prompts, support tickets increase, and your security posture becomes difficult to audit and control centrally. In one organization with ~200 users on per-user MFA and ~400 users on CA policies, this conflict was creating unnecessary friction and made it difficult to implement granular access controls based on risk and resource sensitivity. ...

This documents how our Terraform CI/CD pipeline is set up in GitHub Actions: specifically the auth model, the state backend, the two-file workflow structure, and how I close the loop on post-merge apply results showing up on the PR that triggered them. The Two-File Workflow Structure The pipeline is split into two files: a thin caller and a reusable template. terraform.yml — the caller. It defines the triggers and hands off to the template: ...

Re-reading The Phoenix Project in 2026: The CEO Constraint the Book Missed The Phoenix Project has become canonical for SREs and ops engineers: required reading for understanding DevOps, Theory of Constraints, and why IT organizations fail under their own weight. But re-reading it in 2026, a decade after publication, reveals a critical structural blindspot that undermines its core thesis: the book identifies constraints everywhere except where the real one sits. ...

The Problem Inbound mail was intermittently producing spf=temperror results in Exchange Online despite a valid, RFC 7208-compliant SPF record and no delivery failures. Messages were accepted and delivered, so no NDRs, no user-visible symptoms, but authentication headers showed this: Authentication-Results: spf=temperror (sender IP is 209.85.128.197) smtp.mailfrom=yourdomain.com Received-SPF: TempError (protection.outlook.com: error in processing during lookup of yourdomain.com: DNS Timeout) External resolvers (Google (8.8.8.8), Cloudflare (1.1.1.1)), direct queries to the authoritative nameserver, all resolved the SPF record cleanly and consistently. The timeout was happening exclusively inside Exchange Online’s MTA infrastructure. ...

The Internet Has a Security Blind Spot at Boot Time Most security people focus on the steady state. Is the WAF rule tuned correctly? Is the SIEM catching the right events? Is the policy up to date? What they often miss is the window between “the process started” and “the process is ready.” In Kubernetes, that window can be a meaningful attack surface — and in the case of Fastly’s Next-Gen WAF (formerly Signal Sciences) NGINX Ingress integration, it was. ...